Case Study: Expel boosts SOC efficiency with Pinecone-powered alert similarity

Expel detects 5-6% more similar alerts with Pinecone

Expel, a security operations provider, faced the challenge of maintaining high-quality service and analyst efficiency as they scaled. To help analysts avoid burnout and quickly resolve security alerts, they partnered with vendor Pinecone to develop an Alert Similarity feature using Pinecone's vector database service.

The solution involved transforming security alerts into vector embeddings and using Pinecone to perform fast, accurate similarity searches across millions of records. This allowed Expel to build an Alert Suggestion feature that shows analysts similar past alerts, significantly improving resolution efficiency. The implementation, managed with feature flags to mitigate risk, proved highly successful, with metrics showing that 5-6% of alerts had similar neighbors and the feature saved a substantial number of analyst hours.

Expel